Fine-Grained Access Control via Representational Index Exclusions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing fine-grained access control (FGAC) solutions for relational database management systems (RDBMS) suffer from performance processing inefficiencies, known as performance gaps, when certain SQL query statements are executed, particularly when composite FGAC rules are applied to columns without proper indexing, leading to unnecessary data scanning.
Innovation Solution
The method involves identifying and applying representational index exclusions to modify SQL query statements, allowing for the creation of dynamic pseudo-view objects that restrict data access, thereby enhancing FGAC without introducing performance gaps by using a metadata privacy catalog to store and manage index exclusions at the row, column, or cell level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If composite FGAC rules are applied to columns without proper indexing, then access control security is improved, but query processing performance deteriorates due to unnecessary data scanning
Solution Approach 1:
The system performs preliminary actions by creating representational indexes before query execution. These indexes pre-organize data according to FGAC rules, so when a query is executed, the system can directly utilize the pre-structured index without scanning unnecessary data, thus maintaining both security and performance
Solution Approach 2:
The representational index acts as an intermediary between the raw data and the query processing mechanism. It mediates by providing a pre-organized view of data that already incorporates FGAC restrictions, allowing the query optimizer to efficiently access only authorized data without full table scans
2Productivity
If representational index exclusions are applied to modify query statements, then data retrieval efficiency is improved, but system complexity increases due to metadata management
Solution Approach 1:
The system implements self-service by automatically generating representational indexes and integrating them into query processing without requiring manual intervention. The metadata privacy catalog automatically tracks and manages index exclusions, and the query optimizer automatically utilizes these indexes, reducing the perceived complexity for users
Solution Approach 2:
The system creates simplified copies of the original data structure in the form of representational indexes. These indexes are lighter-weight representations that capture only the necessary data access patterns under FGAC rules, making query processing more efficient while the underlying complex metadata remains managed separately
Data Source
AI summary
A method, system and computer program for implementing fine-grained access control (FGAC) of data stored in a dataset. In response to receiving a data query statement from a user, any representational index exclusions that are relevant to the data query statement are identified, wherein each index exclusion specifies an access restriction to the data. It is then determined whether any of the identified representational index exclusions are to be applied to the data query statement, and if ‘yes’ then the data query statement is modified before being processed, so that processing of the query takes place by searching the dataset under restriction of the representational index exclusions. The proposed approach allows for easy creation and modification of FGAC privacy rules without introducing performance gaps in processing the data query statements.